#TLS

A Custom Domain for Cloud Run: Domain Mappings, a Managed Cert, and a 502 Red Herring

Moving the app off its default *.run.app URL onto a company subdomain with Cloud Run domain mappings: the domain-verification step the runbooks skip, why a zone apex takes A/AAAA records instead of a CNAME, why the cutover order matters when an OIDC audience is involved, and a 502 that looked like a broken deploy but was a TLS cert still propagating.